Arm | Arm Architecture | Instruction Set

The ARM Architecture

Leonid Ryzhyk <leonidr@cse.unsw.edu.au> June 5, 2006

1

Introduction

ARM is a a 32-bit RISC processor architecture currently being developed by the ARM corporation. The business model behind ARM is based on licensing the ARM architecture to companies that want to manufacture ARM-based CPU’s or system-on-a-chip products. The two main types of licenses are the Implementation license and the Architecture license. The Implementation license provides complete information required to design and manufacture integrated circuits containing an ARM processor core. ARM licenses two types of cores: soft cores and hard cores. A hard core is optimised for a specific manufacturing process, while a soft core can be used in any process but is less optimised. The architecture license enables the licensee to develop their own processors compliant with the ARM ISA. ARM processors possess a unique combination of features that makes ARM the most popular embedded architecture today. First, ARM cores are very simple compared to most other general-purpose processors, which means that they can be manufactured using a comparatively small number of transistors, leaving plenty of space on the chip for application-specific macrocells. A typical ARM chip can contain several peripheral controllers, a digital signal processor, and some amount of on-chip memory, along with an ARM core. Second, both ARM ISA and pipeline design are aimed at minimising energy consumption — a critical requirement in mobile embedded systems. Third, the ARM architecture is highly modular: the only mandatory component of an ARM processor is the integer pipeline; all other components, including caches, MMU, floating point and other co-processors are optional, which gives a lot of flexibility in building application-specific ARM-based processors. Finally, while being small and low-power, ARM processors provide high performance for embedded applications. For example, the PXA255 XScale processor running at 400MHz provides performance comparable to Pentium 2 at 300MHz, while using fifty times less energy. This report is largely based on material from Steve Furber’s book about the ARM architecture [Fur00]. Other sources are referenced throughout the report.

1

Acorn decided to pick up the Berkeley approach. which also became the first commercial RISC processor in the world. Curiously. the Berkeley RISC 1 project had shown that it had actually been possible to build a very simple processor with performance comparable to the most advanced CISC processors of the time. MMU support and 64-bit multiplyaccumulate instructions. and contains only 30000 transistors. It used less than 25. standing for Advanced RISC Machines. It was implemented in ARM 6 and ARM 7 cores. The release of these processors and the Apple Newton PDA in 1992 marked ARM’s move to the embedded market. resources required for such a project were well beyond what the company could afford. but still performed comparably to or even outperformed the Intel 80286 processor that came out at about the same time. They quickly discovered that existing commercial microprocessors did not satisfy their requirements. were driven by microcode and had very complex instruction sets. The 4th generation of ARM cores came out in 1996. the ARM v2 architecture was implemented with on-chip cache in the ARM3 processor. However. They had complex instruction sets that included instructions taking hundreds of cycles to execute. The most prominent representative of the 4th generation of ARM’s is the ARM7TDMI core. These processors were slower than standard memory parts available at the time. and two years later. The reason for these deficiencies was that early integrated microprocessors were modelled after processors of minicomputers. The third version of the ARM architecture was developed by this company and featured 32-bit addressing. A joint venture was co-founded by Acorn and Apple to design a new processor. In early 80’s. in particular. Therefore. microprocessor architectures became so complex that it took many years even for large companies with significant expertise in the area to design a new processor. In 1990 Apple made a strategic decision to use an ARM processor in their Newton PDA. Thumb code takes 40% less space compared to regular 32-bit ARM code but is slightly less efficient. Fortunately. including the video iPod. Later.2 History The history of ARM started in 1983. they released their first 26-bit Acorn RISC Machine (ARM) processor. just two years before this. it is used in most Apple iPod players. in 1985. The company was called ARM. The main new feature introduced in ARM version 2 was coprocessor support. which consisted of many chips. which still remains the most popular ARM product. This first ARM architecture is now referred to as the ARM version 1 architecture. leading to high interrupt latencies. when a company named Acorn Computers was looking for a 16-bit microprocessor for their next desktop machine. Acorn engineers considered designing their own microprocessor. ARM7TDMI is based on essentially the same 3-stage pipeline as the very first ARM designed in 1985. It was followed by the second processor in 1987.000 transistors — a very small number even for 1985. The main innovation in this version of the architecture was support for Thumb 16-bit compressed instruction set. Another popular implementation of the ARM v4 architecture 2 .

ARM11 MPCore ? Table 1: History of the ARM architecture is the Intel StrongARM processor. The 6th generation of the ARM architecture was released in 2001 introducing SIMD instruction set extension. the ARM ISA is a load-store one. improved Thumb instruction set.Version v1 v2 v3 v4 v5 v6 v7 Year 1985 1987 1992 1996 1999 2001 ? Features The first commercial RISC (26-bit) Coprocessor support 32-bit. multiprocessing VFP-3 Implementations ARM1 ARM2. In 1999. the original Berkeley RISC design used register windows to speedup procedure invocations. 3 ARM ISA overview In most respects. Thumb-2. the ARM architecture features a large register file with 16 general-purpose registers. References: [Lev05]. TrustZone. and multiprocessor support. Like all RISC architectures. ARM7 ARM7TDMI. XScale ARM11. The recently released ARMv7 architecture features extended SIMD instruction set and improved floating point support. including network processors. The most popular implementation of this architecture is the Intel XScale processor. smart-phones. First. the 5th generation of the ARM architecture introduced digital signal processing and Java byte code extensions to the ARM instruction set. In retrospect. ARM9TDMI. All ARM instructions are 32-bit long and most of them have a regular three-operand encoding. ARM is a RISC architecture. It is used in a variety of high-end embedded devices. StrongARM ARM10. instructions that process data operate only on registers and are separate from instructions that access memory. 64-bit MAC Thumb DSP and Jazelle extensions SIMD. this appears to be a wise decision. ARM3 ARM6. However. Table 1 summarises the history of the ARM architecture. All of the above features facilitate pipelining of the ARM architecture. as register windows did not prove to be a 3 . Finally. that is. ARM8. MMU. and PDA’s. the desire to keep the architecture and its implementation as simple as possible prompted several design decisions that deviated from the original RISC architecture. ARM designers rejected this feature as one that would increase size and complexity of the processor. the TrustZone virtualisation technology.

and the other — to perform the actual data transfer. they significantly speedup performance-critical operations. and lead to more compact code. such as pipeline-friendlyness and simplicity. data transfer instructions are one important exception. which makes it even more appealing to embedded systems developers. where the value of an index register is incremented or decremented while a load or store is in progress. Register 13 is typically used as stack pointer. 3. The general-purpose register number 14 has is used as a link register by the branch-and-link instruction (see Section 3. but can be manipulated as a generalpurpose register. although this is not mandated by the architecture. The ‘I’ and ‘F’ flags enable normal and fast interrupts respectively. In summary. the operating system can achieve protection and isolation. This is essential for building an efficient 3-stage fetch-decode-execute pipeline. ARM supports multiple-register-transfer instructions that allow to load or store up to 16 registers at once. While all modern ARM implementations have separate instruction and data caches and can complete a memory transfer in one cycle. While most ARM data processing instructions do complete in one cycle. By running application software in user mode. ‘Zero’. requires a Harvard architecture with separate instruction and data memories. Third. while deviating from it in few aspects. ‘Carry’. which was considered too expensive by the designers of the first ARM processor. 4 .1 Registers The ARM ISA provides 16 general-purpose registers in the user mode (see Figure 1).particularly useful feature and are not used in the majority of modern RISC processors. However. they still support the auto-indexing mode that proved to improve performance and code size of ARM programs. in order to achieve better utilisation of the pipeline during 2-cycle instruction executions.1) instruction sets. Register 15 is the program counter. and ‘oVerflow’) and four fields reflecting the execution state of the processor. Performing two memory accesses in one cycle would. While violating the one cycle per instruction principle. The current program status register (CPSR) contains four 1-bit condition flags (‘Negative’. The ‘T’ field is used to switch between ARM and Thumb (Section 8. they introduced an auto-indexing addressing mode. Finally. the ‘mode’ field selects one of seven execution modes: • User mode is the main execution mode. such as procedure invocation and bulk data transfers. the ARM architecture offers all the benefits of the RISC approach. the classical RISC approach requires the execution stage of any instruction to complete in one cycle. Second. Completing a simple store or load instruction in one cycle would require performing two memory accesses in a single cycle: one — to fetch the next instruction from memory.4). in its turn.

• Normal interrupt processing mode is entered whenever the processor receives an interrupt signal from any other interrupt source. In order to further reduce the amount of state that 5 . • System mode is used for running privileged operating system tasks. Those privileged modes that are activated in response to exceptions have their own R13 and R14 registers. In addition to user-visible registers. which allows to avoid saving the corresponding user registers on every exception. • Fast interrupt processing mode is entered whenever the processor receives an interrupt signal from the designated fast interrupt source. SPSR registers are used to store a copy of the value of the CPSR register before an exception was raised. • Software interrupt mode is entered when the processor encounters a software interrupt instruction. ARM provides several registers available in privileged modes only (shaded registers in Figure 1).r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r10 r11 r12 r13 r14 r15 (PC) 31 0 CPSR N Z C V unused I F T mode r8_fiq r9_fiq r10_fiq r11_fiq r12_fiq r13_fiq r14_fiq r13_svc r14_svc r13_abt r14_abt r13_irq r13 r14_irq r14 r13_und r13 r14_und r14 CPSR SPSR_fiq SPSR_svc SPSR_abt SPSR_irq SPSR_und user mode system mode fiq mode svc mode abort mode irq mode undef mode Figure 1: ARM registers All other execution modes are privileged and are therefore only used to run system software. • Abort mode is entered in response to memory faults. • Undefined instruction mode is entered when the processor attempts to execute an instruction that is supported neither by the main integer core nor by one of the coprocessors. Software interrupts are a standard way to invoke operating system services on ARM. This mode can be used to implement coprocessor emulation.

Two auto-indexed addressing modes are supported: the pre-indexed mode uses the computed address for the load or store operation. ARM also supports several multiply and multiply-accumulate instructions that take two 32-bit register operands and return a 32. while the second operand can be either register or immediate. Value in the base register is added to the offset stored in a register or passed as an immediate value to form the memory address for load or store. ARM supports binary comparison operations that do not return any values but only modify condition flags in the CPSR register. Therefore. Single-register transfer instructions provide a flexible way to move 1. Multiple-register transfer instructions allow to load or store any subset of the 6 . 2.or 64-bit result. As was mentioned above. or 4-byte blocks between registers and memory. An auto-indexed addressing mode writes the value of the base register incremented by the offset back to the base register. The main addressing mode is base-plus-offset addressing. while multiple-register transfer instructions provide an efficient but less flexible way to move larger amounts of data. Finally. One interesting feature of the ARM architecture is that modification of condition flags by arithmetic instructions is optional. ARM provides 5 additional registers available in the fast interrupt processing mode only. in the original ARM pipeline loads and stores took two cycles to execute. 3. The first operand and the result should be stored in registers. the second operand can be shifted or rotated before being sent to the ALU. while the post-indexed mode uses the unmodified base register for the transfer. subtraction. In the former case. but it can be done later in the instruction stream provided that other intermediate instructions do not change the flags. and then updates the base register to the computed value.has to be saved during handling of fast interrupts. auto-indexed addressing was introduced to keep the pipeline busy while the processor is reading or writing memory. so it is possible to access the value in the next memory location in the following instruction. and then updates the base register to the computed address. without wasting an additional instruction to increment the register. 3.3 Data transfer instructions ARM supports two types of data transfer instructions: single-register transfers and multiple-register transfers. which means that flags do not necessarily have to be read right after the instruction that set them. Due to the limited space available for operand specification inside the 32-bit instruction. and bit-wise logical operations that take two 32-bit operands and return a 32-bit result that can be independently specified in the 3-address instruction format. an immediate operand should be a 32-bit binary number where all the binary ones fall within a group of eight adjacent bit positions on a 2-bit boundary.2 Data processing instructions The ARM architecture provides a range of addition.

the memory address computed by the ALU is placed on the address bus and the actual memory access is performed during the second cycle of the execute stage. If it is a load or store instruction. Under normal conditions. multiple instruction issue.4 Control flow instructions In addition to usual conditional and unconditional branch instructions. the result generated by the ALU is written directly to the register file and the execution stage completes in one cycle. Finally. even the latest ARM pipelines remain quite simple. if necessary. The first pipeline stage reads an instruction from memory and increments the value of the instruction address register. which. 4 Evolution of the ARM pipeline One important property of the ARM architecture mentioned above is its simplicity. Note that since PC is accessible as a general-purpose register. 4. register renaming. and other complex optimisations found in modern microprocessors. This section traces the evolution of the ARM integer pipeline between ARM1 and ARM11 processors. Without register windows. which stores the value of the next instruction to be fetched. reads or writes memory. If a data processing instruction specifies R15 as its destination operand. completes one instruction per cycle. speculation. Autoindexed addressing modes are also supported for multiple-register transfers. it is incremented on every cycle during the fetch stage. In case the instruction being executed is a data processing instruction.sixteen general-purpose registers from/to sequential memory addresses. It is a classical fetch-decode-execute pipeline. performs ALU operations. 3. and finally writes back modified register values. ARM supports efficient procedure invocations using a branch-and-link instruction that saves the address of the instruction following the branch to R14. the ARM architecture provides support for conditional execution of arbitrary instructions: any instruction can be predicated using values of CPSR condition flags. out-of-order execution. The next stage decodes the instruction and prepares control signals required to execute it on. there are several places in the pipeline where the next instruction address can be issued. a load to R15 has a similar effect. then the result of the ALU operation is used as the next instruction address. The third stage does all the actual work: it reads operands from the register file. 7 .1 The 3-stage pipeline Figure 2a shows the original 3-stage ARM pipeline that remained essentially unchanged from the first ARM processor to the ARM7TDMI core. in the absence of pipeline hazards and memory accesses. This value is also stored in the PC register.

+4 instruction read fetch +4 I-cache fetch decode decode decode decode register read register read instr. address register read register execute +4 shift +4 shift shift ALU mul ALU mul data1 data D-cache D-cache data2 register write write-back register write write-back (c) ARM10TDMI Figure 2: Evolution of the ARM pipeline (d) ARM11 8 . address register instr. address mul instr. address mul +4 execute shift shift +4 ALU execute ALU mem r/w D-cache data register write register write write-back (a) ARM7TDMI (b) ARM9TDMI fetch1 +4 branch predictor I-cache instruction queue +4 I-cache branch predictor instruction queue fetch fetch2 decode decode decode decode register read instr.

this allowed to fetch two instructions on each cycle. This trivial algorithm eliminates the penalty of branches for loops that execute many times. because the next instruction cannot be fetched while memory is being read or written.3 The 6-stage pipeline The ARM10 core made further improvements to the pipeline structure (see Figure 2c). Designers realised that the pipeline performance was mainly constrained by memory bandwidth. is to use separate instruction and data caches. Therefore. the execute stage was split into 3 stages. 9 . the second stage performs memory accesses (this stage remains idle when executing data processing instructions) and the third stage writes the results back to the register file. hindering further growth of clock frequency. which can run at faster clock rate. since instruction decode stage was much shorter than the execute stage. 4. Since multiply instructions do not read or write memory. ARM10 unloaded the execute stage by introducing a separate adder for multiply-accumulate instructions instead of using the main ALU to do addition. this adder could be placed to the data stage. One way around this problem. In the execution section of the pipeline. which was used in ARM9TDMI (Figure 2b) and later microarchitectures. Since address computation is always just a simple addition. The branch predictor tries to look ahead the instruction stream and predicts backward pointing branches as taken and forward pointing branches as not taken. 64-bit data bus allowed to improve the performance of multiple-register transfer instructions by transferring two registers at a time. which means that every data transfer instruction causes a pipeline stall. This results in a much better balanced pipeline. this adder could complete its computation in less than 1 cycle. which lead to a better balanced pipeline and enabled it to run at a higher clock rate. This allows to modify the pipeline to avoid stalls on data transfer instructions.4. effectively leaving one and a half cycles for the memory access. ARM9TDMI moved the register read step to the decode stage. but there is one new complication — the need to forward data among pipeline stages to resolve data dependencies between stages without stalling the pipeline. Next. First. they made both instruction and data buses 64-bit-wide. The forwarding paths are shown with black arrows in Figure 2b.2 The 5-stage pipeline The pipeline structure shown in Figure 2a assumes availability of only one memory port. the memory access stage became the longest running pipeline stage. to make the pipeline more balanced. In order to remove this performance bottleneck. The last improvement introduced in the ARM10 pipeline was separation of instruction decoding into a separate stage. Second. which enabled the introduction of a static branch prediction unit. another adder dedicated to address computation was introduced. At this point. In the fetch stage. The first stage performs arithmetic computations.

all exceptions are handled in a similar way: the processor switches to the corresponding execution mode (see Section 3. FIQ is also disabled). • Normal interrupt exception is raised whenever the processor receives an interrupt signal from any non-fast interrupt source. 5 Exceptions The ARM architecture defines the following types of exceptions (listed in the order of decreasing priority): • Reset starts the processor from a known state and renders all other pending exceptions irrelevant. saves the old value of CPSR to SPSR of the new mode. • Prefetch abort exception is raised by memory management hardware when memory access permissions are violated during instruction fetch. saves the address of the instruction following the exception entry instruction in R14 of the new mode. • Fast interrupt exception is raised whenever the processor receives an interrupt signal from the designated fast interrupt source. fetch and decode stages are executed in order. Second. typically to request an operating system service. • Software interrupt exception is raised by a special instruction. Still.4 The 8-stage pipeline The ARM11 core introduced two main changes to the pipeline architecture (see Figure 2d). disables IRQ (in case of a fast interrupt. the shift operation was separated into a separate pipeline stage.4. Except for the reset exception. Note that the instruction execution section of the resulting 8-stage pipeline is split into three separate pipelines that can operate concurrently in some situations and can commit instructions out-of-order. both instruction and data cache accesses are now distributed across 2 pipeline stages. • Undefined instruction exception is generated when trying to decode an instruction that is supported neither by the main integer core nor by one of the coprocessors. 10 .1). First. • Data abort exception is raised by memory management hardware when a load or store instruction violates memory access permissions. and starts execution from the relevant exception vector.

Coprocessors are required to expose a load-store architecture. However. The second type of coprocessor instructions are load-store instructions that transfer data between coprocessor registers and memory. First. The instruction cache is read-only. No matter what the native coprocessor register size is. The ARM architecture defines a protocol for interaction between the main ARM core and coprocessors and instructions for data transfer between ARM and coprocessors. These are completely internal to the coprocessor. Each coprocessor can have up to sixteen registers of any size. the ARM floating point unit is implemented as a coprocessor. Simple systems that run a predefined set of applications and do not require fullfeatured protection are equipped with simple protection units. Both caches are typically virtually addressed and set-associative with high degree of associativity (up to 64-way). The ARM core initiates execution of such instructions by computing a memory address and sending it to the address bus. these operations transfer 32-bit values only. caches. In most implementations. the ARM architecture supports register transfer instructions that transfer data between the integer pipeline and coprocessor registers. There are three types of coprocessor-related instructions recognised by the main ARM core. cache is split into separate instruction and data caches. For example. One less standard feature present in most ARM processors is cache lock-down capability that allows to lock critical sections of code or data in cache. there are data processing instructions.6 Coprocessors The ARM architecture supports a general mechanism for extending the instruction set through the addition of coprocessors. Finally. since the ARM core does not know the size of coprocessor registers. Another example of a coprocessor is the system control coprocessor that manages MMU. 7 7.2 Memory protection ARM-based chips come with one of two types of memory protection hardware. A protection unit does not provide address translation. it executes a simple handshake protocol to make sure that one of coprocessors accepts this instruction. but simply defines eight regions within the 11 . TLB. the coprocessor controls the number of transferred words itself.1 Memory hierarchy Cache All modern ARM-based processors are equipped with either on-chip L1 cache or on-chip memory. Whenever the ARM core fetches such an instruction. 7. and the write buffer. while the data cache is read/write with copy-back write strategy.

64K. and 1K. it typically 12 . In some situations. or can have no access to the domain at all. One major concern associated with memory protection is the cost of address space switching. which means simply writing a new value to the domain access register of coprocessor 15. 8 8. The MMU supports two-level page tables with page sizes of 1M. virtual addresses issued by a program within the first 32 megabytes of the address space are effectively augmented by the value of the process identifier (PID) register. a client of the domain. At any point in time. however it is still necessary to flush TLBs. Other types of pages are described by second-level page table entries. References: [WH00]. On execution. Although Thumb code uses 40% more instructions than equivalent 32-bit ARM code.1 ARM ISA extensions Thumb The Thumb instruction set was introduced in the fourth version of the ARM architecture in order to achieve higher code density for embedded applications. these 16bit instructions can be either decompressed to full 32-bit ARM instructions or executed directly using a dedicated Thumb decoding unit. the running process can be either a manager of a domain. Every virtual memory page or section belongs to one of sixteen protection domains. it is possible to do context switch by simply changing domain access permissions. On ARM a context switch requires switching page tables. which means that is can access pages belonging to the domain according to their page table access permission bits. The second mechanism present in newer ARM cores is the fast context switch extension (FCSE) that allows multiple processes to use identical address ranges. 4K. The first mechanism is protection domains. Thumb provides a subset of the most commonly used 32-bit ARM instructions which have been compressed into 16-bit wide opcodes. [Sea00].4-gigabyte physical address space and allows assigning access permissions and cacheability attributes to individual regions. General-purpose ARM-based systems are equipped with memory management units (MMU) that provide a virtual memory model similar to conventional desktop and server processors. which means that it can access all pages belonging to this domain bypassing access permissions. To that end. Two mechanisms were introduced to enable operating system designers eliminate this cost in some cases. 1M pages are called sections and are described by first-level page table entries. while ensuring that the addresses they present to the rest of the memory system differ. purging TLBs and caches and then refilling them. Address translations are cached in separate address and data translation lookaside buffers (TLB) typically implemented as fully associative caches. FCSE allows to avoid the overhead of purging caches when performing a context switch. The complete cost of page table switch includes the cost of flushing page tables.

3 DSP extensions ARM-based systems typically perform signal processing tasks using dedicated DSP coprocessors. in some cases it is convenient to have some DSP support provided by the main ARM core. 2004. etc. IEEE Computer. 2005. [Lev05] Markus Levy. References: [GS05]. Addison-Wesley. secure software upgrades.4 TrustZone The TrustZone extension enables creation of a trusted computer base (TCB) within a system-on-chip. The history of the ARM architecture: From inception to IPO. [AF04]. ARM IQ. 4(1). 2005. [Fur00] Steve Furber. Thumb code is 40% slower than ARM code.2 Jazelle Jazelle is a hardware implementation of the Java virtual machine that allows ARM processors to execute Java bytecode. TrustZone: integrated hardware and software security. In the sixth version of the ARM architecture. The hardware implementation avoids the overhead of software approaches.requires 30% less space. Parallelism and the ARM instruction set architecture. 8. 8. cryptographic key management. 38(7):42–50. References [AF04] Tiago Alves and Don Felton. therefore Thumb is usually used only in non-performance-critical routines in order to reduce memory and power consumption of the system. 2nd edition. such as software emulation of the virtual machine or JIT compilation. ARM whitepaper. 13 . However. 2000. 8. on-chip or off-chip secure memory and peripherals. such as system software integrity checking. [GS05] John Goodacre and Andrew N. The TCB can be used to perform security-related tasks. It features support for saturating addition and subtraction operations and 16-bit multiplication. Such TCB can include a small set of trusted applications running in a special privileged execution mode outside the main operating system. A corresponding ISA extension was introduced in the fifth version of the architecture. Sloss. ARM System-on-Chip Architecture. DSP support evolved into the SIMD instruction set extension that allows simultaneous execution of two 16-bit or four 8-bit arithmetic instructions.

In Proceedings of the 5th Australasian Computer Architecture Conference. IEEE CS Press. [WH00] Adam Wiggins and Gernot Heiser. 2000.[Sea00] David Seal. Canberra. pages 97–104. Fast address-space switching on the StrongARM SA-1100 processor. Addison-Wesley. Australia. ARM Architecture Reference Manual. 14 . January 2000. 2nd edition.

Sign up to vote on this title
UsefulNot useful